Posted by: Pdfprep
Post Date: March 23, 2021
An administrator is searching for any child processes of email clients with this query in Carbon Black Enterprise EDR:
parent_name:outlook.exe OR parent_name:thunderbird.exe OR parent_name:eudora.exe
The administrator would like to modify this query to only show child processes that do not have a known reputation in the Carbon Black Cloud.
Which search field can be added to the query to show the desired results?
A . process_integrity_level
B . process_reputation
C . process_privileges
D . process_cloud_reputation
Answer: B